marketing-os-starter

SUSPICIOUS: The skill’s marketing automation purpose mostly matches its capabilities, and there is no clear credential theft or malicious payload. Risk comes from install trust mismatch (ara.so branding vs personal GitHub source), unpinned source installation, and optional third-party MCP integrations that are only loosely specified. Overall this looks more like a moderately risky, loosely sourced workflow skill than malware.